How does traceroute work?
Show the answer
Say this first
It sends probes with TTL 1, then 2, then 3, and so on. Each router that decrements the TTL to zero drops
the probe and returns ICMP time exceeded (type 11), which reveals its address. The destination answers
differently: ICMP port unreachable for a UDP probe, or an echo reply for an ICMP probe, and that ends the
trace. Linux, macOS and Cisco IOS send UDP to high ports starting at 33434. Windows tracert sends ICMP
echo. Three probes per hop by default.
Go deeper
Step by step
- The first probe leaves with TTL 1. The first router decrements it to 0, drops it, and sends ICMP type 11 code 0 (TTL exceeded in transit) back from its own address, usually the interface facing you.
- The probe with TTL 2 expires at the second router, and so on.
- The destination gets a probe with TTL still above zero. For UDP to an unused high port it answers ICMP type 3 code 3 (port unreachable). For ICMP echo it sends an echo reply. Either one ends the trace.
Variants
| Tool | Probe | End signal |
|---|---|---|
Linux and macOS traceroute | UDP, port 33434 and up | port unreachable |
traceroute -I | ICMP echo | echo reply |
traceroute -T -p 443 (Linux, root) | TCP SYN | SYN-ACK or RST |
Windows tracert | ICMP echo | echo reply |
Cisco IOS traceroute | UDP, port 33434 and up | port unreachable |
Reading a line
Each hop shows three round-trip times, one per probe. The time includes how long that router's CPU took
to build the ICMP message. Cisco marks * for a timeout and codes such as !H (host unreachable),
!N (network unreachable) and !A (administratively prohibited).
They will ask next
Why does Unix traceroute use high UDP ports?
So nothing is likely to be listening at the destination, which makes the host answer with port unreachable and tells traceroute it has arrived. The port changes per probe so replies can be matched.
A firewall blocks UDP probes. What do you use instead?
ICMP with
traceroute -Ior Windowstracert, or TCP to an allowed port withtraceroute -T -p 443. A TCP trace to the service port is subject to the same firewall rules as the application.How does traceroute match a reply to its probe?
An ICMP error quotes the original IP header and at least the first 8 bytes of the original payload, which hold the UDP ports or the ICMP identifier and sequence. traceroute matches on those.
Traps
- Saying traceroute shows the return path. It shows the forward path only.
- Saying Windows
tracertuses UDP. It uses ICMP echo.